18 ms·

SingleFile version compatible with Manifest V3

320 points by keks24 4y ago

zagrebian 4y ago
> It is an evolution of the extension platform that takes into consideration both the changing web landscape and the future of browser extensions. These are such empty words that could mean anything. I wonder if the author is a politician.
rasz 4y ago
>Benefits of the Manifest V3 >none Tom here lists all the benefits of V3: https://www.youtube.com/watch?v=OTFqmfyM4TQ https://www.youtube.com/watch?v=OTFqmfyM4TQ
- Closi 4y ago
  Google: We love manifest because we love money, and hate things that get in-between us and more money.
- IshKebab 4y ago
  Come on. There are clear security and privacy benefits. You might not like the trade-off but pretending that there are no benefits just tells me that you're being disingenuous and I can ignore your opinion.
  - rany_ 4y ago
    The benefits exist if you treat the user like an absolute buffoon that can't handle installing extensions. If you really wanted to, just put a massive warning screen before installing extensions that require dangerous permissions. I'm sure the future without MV2 will have users launching .exe files to mod Chrome which is much much worse (similar to what's going on with Discord and other Electron app mods).
    - jve 4y ago
      I'm not into position commenting Manifest V2 vs V3 as I don't write extensions. > The benefits exist if you treat the user like an absolute buffoon that can't handle installing extensions. If you really wanted to, just put a massive warning screen before installing extensions that require dangerous permissions. But... what different is it than installing software? And "big scary warning" is what one of things Windows UAC brought you. It helps some folks, but otherwise it is "just push OK". I like how Android/iOS handles - I can approve/reject specific permission upon request and only grant it while using app/this time only.
      - rany_ 4y ago
        Well, the big scary warning is important to grab the attention of people that don't understand the significance of installing said extension. You'd be surprised by the amount of people that are shocked by the fact that an extension they installed has blanket permissions.
        madeofpalk 4y ago
        Exactly. You see the motivation now.
        rany_ 4y ago
        I see the "motivation" but I meant that if they were being genuine they should have attempted better extension install screens. The current one just lists "Access to all websites" as a normal permission as if it's no big deal.
    - random_cynic 4y ago
      > I'm sure the future without MV2 will have users launching .exe files to mod Chrome which is much much worse Average internet (hence chrome user) don't even know what mod means. They don't care about ads (at least not enough to actively make any change). If the ads become too annoying they'll just skip the video or won't visit a website again and the people serving the ads know that.
- nicexe 4y ago
  The "none" comment comes from the point of view developing this specific browser extension.
  - ithkuil 4y ago
    Other extensions would possibly list some benefits but also possible more problems?
m00x 4y ago
Won't this break Honey's extension business model where they inject Referer to steal referral $?
- swyx 4y ago
  didnt know that. where can i read more about this?
- kevincox 4y ago
  I thought their primary business model was seeking user data?
  - seanw444 4y ago
    No, the draw is that they supposedly don't. Hijacking referrer data makes sense as to how they manage without that.
betwixthewires 4y ago
So why don't we fork the chromium upstream code and only merge security patches? Imagine, all the web extension maintainers just started maintaining for the forked browser because it's the only one they can continue to support. This would surely destroy the chrome monopoly.
- josephcsible 4y ago
  I think you underestimate how much work maintaining that would be. Also, who's "we"? Are you going to do it?
- c0nducktr 4y ago
  > So why don't we fork the chromium upstream code and only merge security patches? Are you volunteering to do this? Do you have the time for all of that? Edit: Why not just use firefox?
  - neoberg 4y ago
    I want to use Firefox but it drains the battery so fast that there's usually no time left to use it.
- Jorengarenar 4y ago
  And it will get popular between end-users because?
  - the_third_wave 4y ago
    Manifest v3 will be pushed into Android and the Android Webview component and as such become the standard browser for a lot of people. Android makes it possible to change the Webview to something else but most people just leave it as is. Android also doesn't restrict browser choice like iOS does but most people still go with the last version of Chrome since that is what the device came with. With Firefox being led astray due to its activist CEO deeming it more important to use her position to promote identity politics and other destructive ideologies, Brave tainted by its shady crypto/currency ties and most other Blink-based forks - Bromide, Ungoogled Chromium et al - being marginal players at best and Safari being "the new IE" it is to be expected for Manifest v3 to become the default standard bar the rise of a viable alternative. Where is the new Firefox, or maybe Ouroboros - the snake that eats its own tail in a perpetual cycle of birth, destruction and rebirth - is a better name? Where is the GNU browser engine, built to serve the user instead of its master?
deleted 4y ago
[deleted]
bee_rider 4y ago
It sure is going to be annoying when approximately 0 people switch over to firefox due to the manifest V3 stuff.
- bryanrasmussen 4y ago
  probably the people who would care are already there. who saves a website to their local machine other than tech people anymore, for example.
  - mastazi 4y ago
    I care and wasn't already there. I went from Firefox to Brave after the mobile extensions fiasco but, now, I'm coming back to Firefox because of v3 (Brave said they will not block v2, but due to the fact that they don't have their own store, you are forced to do installs from zip files, without auto update, which sucks).
- akmittal 4y ago
  It won't be 0, but very few to make a difference. I moved to MS edge because it blocks ads on mobile.
  - jonas-w 4y ago
    And why not firefox on mobile with ublock origin?
    - meibo 4y ago
      Firefox on Android has terrible scrolling latency/stutter for me and seemingly for a lot of people. On a 120hz screen, which chrome-based browsers can pull off fine, it's a real dealbreaker.
      - sexy_seedbox 4y ago
        Try Firefox Beta, the scrolling is smoother on there and has more features not in the standard version.
tsujp 4y ago
Honestly I hope Google go through with this as it will direct people to Firefox so they can continue using ad-blockers like uBlock Origin. I don't know how many will come but if Google wants to implode their plugin ecosystem in favour of more advertising, and if that action increases Firefox adoption (and thus a healthy browser ecosystem via competition) then I am for it.
- hericium 4y ago
  Google may try to enforce MV3 on Firefox. 90% of Mozilla's income comes from Google and while Google needs this controlled opposition, they may lower their input to almost-suffocate Mozilla whenever they desire.
  - dmitriid 4y ago
    They don't have to do that. They have technical means to suffocate Mozilla. See this thread on sabotage: https://archive.ph/2019.04.15-165942/https://twitter.com/johnath/status/1116871238922776576 https://archive.ph/2019.04.15-165942/https://twitter.com/joh... (archived), https://twitter.com/johnath/status/1116871238922776576 https://twitter.com/johnath/status/1116871238922776576 (original)
    - random_cynic 4y ago
      So google is trying to both kill Mozilla and keep it alive? Are they trying to create a Schrodinger's Mozilla?
      - dmitriid 4y ago
        For a while Google needed Mozilla (and Safari) to point at and say: see, competition. Now that they have Edge, they need neither. Because they can now pretend that Edge is something else but a glorified Chrome fork and follower. See, for example, WebTransport which as a standard doesn't even exist beyond some scribbles on a napkin https://web.dev/webtransport/ https://web.dev/webtransport/ --- start quote --- The WebTransport features described in this article are shipping in Chrome, Edge, and other Chromium-based browsers, starting with version 97. Firefox does not currently have support for WebTransport. Updates on their position can be found in this GitHub issue. Safari does not currently have support for WebTransport. --- end quote ---
2Gkashmiri 4y ago
haha... with microsoft now touting "VPN", the same VPN nonsense BS that facebook did many years ago on mobile because they wanted to extract ALL the data, ALL the time for literally no cost and no benefit to users, this looks like yet another M$ BS.
- Jorengarenar 4y ago
  Where did Microsoft come to the equation from?
  - tech234a 4y ago
    https://news.ycombinator.com/item?id=33037171 https://news.ycombinator.com/item?id=33037171
- xani_ 4y ago
  FF is doing same thing with VPN lmao
  - 2Gkashmiri 4y ago
    nah, FF is reselling mulvad vpn if i am not wrong, plus that is a paid offering so its not like the masses will join it in droves.
la_fayette 4y ago
I have the strong feeling, that so many people like to watch ads. People like to watch ads more than the actual content. So chrome, egde and safari are and will be the people's browsers. Why even bother?
- kaixi 4y ago
  I like ads, but detest cookie banners. Good ads can teach you a lesson about copywriting or storytelling, cookie banners are pure time wasters.
- kramerger 4y ago
  Sergei, is that you?
  - la_fayette 4y ago
    No
erklik 4y ago
I've commented this before in a different thread. It's time we, developers, truly switched to non-Chromium browsers. It's Firefox. The answer to all this is Firefox. Firefox is a legitimate alternative, it works for >99% of the world's websites and is an actual alternative i.e. not a fork of Chromium. We need to support Firefox. I've been using it for nearly the last 5 years full-time and have never needed to open Chrome. Do some Google websites perform worse on Firefox? Sure, but the entire reason that's because people don't use Firefox enough i.e. some websites are worse on Firefox. It's a cycle. People don't use Firefox enough, which is why some websites are not performant on Firefox and so on. Firefox expanded and became famous because of a large amount of developers telling their families and friends that it's the better browser. Same was the case for Chrome. This needs to happen again. As a side note, can someone at Mozilla please make it so that I can donate directly to Firefox? Is that not possible for some reason? If I knew that Mozilla wasn't going to spend my money on some stupid new idea, and it would directly to supporting Firefox development, I would defintely pay a subscription each month to Firefox, and feel like a lot of other people would too.
- avian 4y ago
  Firefox will follow Chrome with this. Over time they always tend to copy Chrome instead of going their own way, as much as their users complain. They similarly already moved away from XUL extensions in the past. I'm sure they will write a heart-breaking story about how supporting Manifest v3 extensions and removing WebRequest blocking is critical for safety and privacy on the web.
  - kramerger 4y ago
    Firefox is already supporting v3 while _also_ supporting v2 for adblockers. Stop these random excuses.
    - avian 4y ago
      I use Firefox exclusively, on my computer and on my phone. I am also incresingly frustrated by the direction Mozilla has been going with it and have very little illusions left what their motivations are.
akmittal 4y ago
Is Microsoft edge going to implement Manifest V3. I found it to have same features as chrome but better privacy.
- tech234a 4y ago
  Edge is a Chromium fork now, and Microsoft has announced that they will be following Google's timeline for depreciating manifest v2, though it looks like their timeline hasn't been updated with the information from Google's latest timeline delay [1]. [1]: https://learn.microsoft.com/en-us/microsoft-edge/extensions-chromium/developer-guide/manifest-v3 https://learn.microsoft.com/en-us/microsoft-edge/extensions-...
- deleted 4y ago
  [deleted]
- NayamAmarshe 4y ago
  > I found it to have same features as chrome but better privacy. Oh boy. Edge is actually worse than Chrome in privacy and data-collection, that's a feat in itself. Source: Trinity College, Dublin Research Paper -https://www.scss.tcd.ie/Doug.Leith/pubs/browser_privacy.pdf https://www.scss.tcd.ie/Doug.Leith/pubs/browser_privacy.pdf
deleted 4y ago
[deleted]
charcircuit 4y ago
I think people are failing to understand that Google wants to start MV3 from a more secure and privacy protecting state and figure out how to incrementally add capabilities without compromising that. Making the tradeoff of reducing your security / privacy / performance for more freedom is not the right call for most people. Extension authors have abused their freedom so it should be taken away.
- the_gipsy 4y ago
  Bottomline is that adblocking extensions are dead.
  - SquareWheel 4y ago
    Have you actually tried using uBlock Origin Lite or Adguard on MV3? I've used both and they have worked flawlessly. Currently I prefer Adguard because all websites are opted-in to cosmetic styling by default.
    - the_gipsy 4y ago
      I can't, because MV3 is not in my version of Chromium yet. But I don't need to: I know exactly how MV3 works, I have experienced that approach on iOS and it barely works for the most simple kind of ad-tech. Calling it "flawless" sounds like outright FUD to me.
      - SquareWheel 4y ago
        FUD is making a dismissive claim without actually testing it. Using the stripped down content blocking in iOS is hardly comparable.
        the_gipsy 4y ago
        iOS works in the exact same principle as MV3.
    - 4y ago
dedoussis 4y ago
> With Manifest V2, it was possible to inject a "Referrer" HTTP header if necessary. With Manifest V3, it's no longer possible. Not entirely sure of how this is true. A recent V3 extension I've built is able to inject both the "Referer" and "Origin" headers using a declarative net request ruleset: 1. manifest.json (referencing the rules.json file): https://github.com/dedoussis/icloud-hide-my-email-chrome-extension/blob/main/src/manifest.json#L19 https://github.com/dedoussis/icloud-hide-my-email-chrome-ext... 2. rules.json: https://github.com/dedoussis/icloud-hide-my-email-chrome-extension/blob/main/src/rules.json https://github.com/dedoussis/icloud-hide-my-email-chrome-ext... 3. Relevant docs: https://developer.chrome.com/docs/extensions/reference/declarativeNetRequest/ https://developer.chrome.com/docs/extensions/reference/decla...
- dedoussis 4y ago
  Oh actually SingleFile is not attempting to set the headers but modify them, which seems to not be possible with V3. That makes sense.
- deleted 4y ago
  [deleted]
a3w 4y ago
Is the title a reference to: "Now witness the power of this fully armed and operational battle station" from Emperor Palpatine? Nice foreshadowing, the battle station did not "go poof" in that scene, though, like singlefile-lite does, thanks to manifest v3.
1vuio0pswjnm7 4y ago
https://arstechnica.com/gadgets/2022/09/chromes-new-ad-blocker-limiting-extension-platform-will-launch-in-2023/ https://arstechnica.com/gadgets/2022/09/chromes-new-ad-block... "Google says Manifest V3 is "one of the most significant shifts in the extensions platform since it launched a decade ago." The company claims that the more limited platform is meant to bring "enhancements in security, privacy, and performance."" Big Tech is not exactly known for its honesty. If it does not also increase profits and/or decrease losses then there is no sense in pursuing it. There is literally nothing Google does that is not sold as being for the benefit of its data sources and ad targets, i.e., "users". Doing things that help lure in or retain the data sources and ad targets is not not the same as doing thing that actually benefit them. At best, what Google does is make compromises, but the announcements never acknowledge any compromise. Everything is a win for the data sources and ad targets. If we are to believe their rhetoric Google's interests and "users'" interests are always exactly the same. Impossible. "Privacy groups like the Electronic Frontier Foundation (EFF) dispute this description and say that if Google really cared about the security of the extension store, it could just police the store more actively using actual humans instead of limiting the capabilities of all extensions." As if anyone else, besides people obligated to support Google, would not "dispute this description". We do not know because those other people are never asked. None of them asked for an update. They have no choice in the matter. Ambivalence does equate to agreement. It makes one wonder why does Google even bother to purportedly disclose the motivation or justification for an "update". No one has a choice to reject it. We never see any evaluations fo the source code changes. So-called "users" are not the stakeholders in this project. "The EFF poked holes in most of Google's justifications for Manifest V3 changes, saying that malicious extensions are mostly interested in stealing data and that Manifest V3 only stops extensions from blocking data, not inspecting it, so Google isn't doing much to stop bad actors. The report says performance also isn't a valid excuse, citing a study showing that ad downloading and rendering degrades browser performance." Tell us something we do not already know. Google's customers are not "users", they are advertisers. As such, statements about the advantages of an "update" really should relate to the advantanges for advertisers. Any other statements are just meant to lure in or retain the data sources and ad targets.
- shadowgovt 4y ago
dedoussis 4y ago
> Benefits of the Manifest V3: none V3 not allowing remote code execution is actually a serious benefit. Of course, this does not negate the fact that V3 is mainly there to boost the ad ecosystem of Google, but I'd never want my screen casting extension to be mining bitcoin on the background. That said, I'm not sure how this is going to scale long term, given that it sometimes takes 2+ weeks for the web store review team to approve a genuine one-line change. Lack of RCE is only going to make this review backlog bigger.
- rasz 4y ago
  >V3 not allowing remote code execution is actually a serious benefit. This is Google Kool-Aid. When Google says "remote code", they mean _remote to google_. Your own script on your own drive is remote to google. Google is removing User from the User Agent.
  - dedoussis 4y ago
    Well, in this instance remote code actually means remote. In V3 one can no longer use the tabs.executeScript API [1] in which you could pass an arbitrary server rendered string. [1] https://developer.chrome.com/docs/extensions/reference/tabs/#method-executeScript https://developer.chrome.com/docs/extensions/reference/tabs/...
    - rasz 4y ago
      V3 kills Userscripts (tampermonkey/violentmonkey). You will no longer be able to execute your own code written with your own hands&brain and stored on your own hard drive.
      - abraham 4y ago
        Userscripts should go into testing soon. https://developer.chrome.com/docs/extensions/mv3/known-issues/#userscript-managers-support https://developer.chrome.com/docs/extensions/mv3/known-issue...
      - 4y ago
josteink 4y ago
Devils advicate: I know hating on manifest V3 is popular. I know especially content-blockers (which I myself enjoy!) face issues with the new permissions model. That said, I've ported an above moderately complex extension from manifest V2 to V3 and found the experience quite OK. * The permission model is more clearly defined. * Background-workers instead of background-pages makes for a more consistent API. IMO background-pages were always weird. * Usage of obsolete APIs which may have "suddenly" failed in V2, now actually immediately causes runtime-failures in V3, making sure you've get all of them upgraded. * You need to be explicit when doing "dangerous" things like injecting scripts. There's nothing accidental about this. This clearly improves security. * Time taken? Roughly one work-day. * No functionality lost. Right now, as a developer, my only complain about V3 for this extension... That I no longer can have a single, consistent codebase for the Chrome and Firefox-versions, because Firefox doesn't yet support V3 in their regular end-user builds. But once they do, that problem will be solved too. And as an end-user, I really feel this security-model makes extensions which can operate within the V3-constraints more trustworthy than similar extensions implemented using V2.
- raxxorraxor 4y ago
  > You need to be explicit when doing "dangerous" things like injecting scripts. There's nothing accidental about this. This clearly improves security. What do you mean here? How do scripts get included explicitly?
- danpalmer 4y ago
  Thank you for adding some context to this that seems missing from all discussion I've seen so far. Extensions have always had a dodgy security model, and given the nearly unprecedented access they have to our data and habits, it's important that this is being improved. Most users aren't going to be able to tell the difference between a good extension and a malicious one, and even developers who would like to think they can probably can't in many cases. It sounds like security and performance are significantly improved, and these are both things that the tech community are usually big supporters of. But in this case it comes at the cost of some flexibility with ad-blocking, and if there's one thing we love more than security and performance, it's a chance to point the finger at big tech. There's a lot of nuance that has been lost from the ad-blocking discussion.
hdjjhhvvhga 4y ago
Actually it's a great ad for SingleFile and FireFox. Seems to work great so far.
xani_ 4y ago
Why is FF going with it ?
- creesch 4y ago
  Simple, they switched to the webextension API a few years ago as it makes development of extension across browsers much easier. More directly put, developers would develop extensions for Chrome and more often than not would not bother with Firefox as the framework it used was different. By switching to the same framework for developing extensions it now means that it takes little to no effort for developers to also publish it for firefox. Having said that, Firefox is providing compatibility with manifest v3 while at the same time not implementing some of the restrictions that are in place in the Chrome implementation.
  - pessimizer 4y ago
    > Simple, they switched to the webextension API a few years ago as it makes development of extension across browsers much easier. Great idea to prioritize interop when the people who you're trying to interop with are gulping large chunks of your userbase. Very important to make sure that Firefox had parity with Chrome in extensions, the only area where Firefox previously had a massive advantage over Chrome.
    - creesch 4y ago
      > the only area where Firefox previously had a massive advantage over Chrome. It didn't though, because the API was different a lot of extensions that appeal to a broader user base were not made available on firefox (anymore). Yes, the previous framework did allow other use cases more suitable for power users but those are a fraction of the total user base. And in general it hugely simplified extension development. Instead of having to maintain various code paths for different browsers and accounting for slightly incompatible APIs this was no longer needed.
- RunSet 4y ago
  > More than 90 per cent of Mozilla's funding comes from web search providers that pay for the right to be the default search engine in Firefox in their regions. According to the organization's latest financial figures, $430m of its 2018 total revenue of $451m came from those internet giants – primarily Google https://www.theregister.com/2020/08/14/mozilla_google_search/ https://www.theregister.com/2020/08/14/mozilla_google_search...
hanselot 4y ago
Has anything good come from a manifesto in history? Or is it selection bias that I only associate the word with dictators and genocides?
gildas 4y ago
Author here, I just wanted to add that most of the "features" should be fixed by Google this month [1]. That leaves me approximately 2 months to finish the work and hope to make the transition in January \o/. This delay is a bit short though. [1] https://developer.chrome.com/docs/extensions/mv3/known-issues/ https://developer.chrome.com/docs/extensions/mv3/known-issue...
- dancemethis 4y ago
  Gotta add _somewhere_ an introduction to what it actually is. I could figure it is _related_ to extensions, but what it _is and does_ is nowhere. Only empty buzzing like "It is an evolution of the extension platform that takes into consideration both the changing web landscape and the future of browser extensions."
- Zababa 4y ago
  Thanks a lot for SingleFile, I use it all the time to save web pages and it's great!
shadowgovt 4y ago
> Benefits of the Manifest V3 * This extension is much less likely to consume all of my JavaScript resources when it malfunctions * I, as the end user, can install this extension without fear that arbitrary code execution of code sourced from the web means the extension creator can change the extension to harvest my data later without anything changing in the Chrome Web Store to indicate this has happened The bugs need to be fixed, but the benefits are for end users not developers.
- josephcsible 4y ago
  Those benefits are like saying a benefit of having a flat tire is that you're way less likely to get a speeding ticket while you do. Or even better, like the benefits of the Sun going out that https://what-if.xkcd.com/49/ https://what-if.xkcd.com/49/ lists.
  - shadowgovt 4y ago
    It's about tradeoffs. From where I sit (not running an ad blocker, but yes running several extensions on a corporate machine), the benefits outweigh the costs because while currently corporate IT has to allow-list every extension one-by-one, Mv3 allows them to have a policy where they trust the Chrome Web Store and allow us to install extensions as long as they don't demand XYZ permissions.
jen20 4y ago
The objective listed makes no mention of what this project _actually is_ - infuriating.

320 points by keks24 4y ago

> It is an evolution of the extension platform that takes into consideration both the changing web landscape and the future of browser extensions. These are such empty words that could mean anything. I wonder if the author is a politician.

rasz 4y ago

>Benefits of the Manifest V3 >none Tom here lists all the benefits of V3: https://www.youtube.com/watch?v=OTFqmfyM4TQ https://www.youtube.com/watch?v=OTFqmfyM4TQ

Closi 4y ago
Google: We love manifest because we love money, and hate things that get in-between us and more money.
IshKebab 4y ago
Come on. There are clear security and privacy benefits. You might not like the trade-off but pretending that there are no benefits just tells me that you're being disingenuous and I can ignore your opinion.
- rany_ 4y ago
  The benefits exist if you treat the user like an absolute buffoon that can't handle installing extensions. If you really wanted to, just put a massive warning screen before installing extensions that require dangerous permissions. I'm sure the future without MV2 will have users launching .exe files to mod Chrome which is much much worse (similar to what's going on with Discord and other Electron app mods).
  - jve 4y ago
    I'm not into position commenting Manifest V2 vs V3 as I don't write extensions. > The benefits exist if you treat the user like an absolute buffoon that can't handle installing extensions. If you really wanted to, just put a massive warning screen before installing extensions that require dangerous permissions. But... what different is it than installing software? And "big scary warning" is what one of things Windows UAC brought you. It helps some folks, but otherwise it is "just push OK". I like how Android/iOS handles - I can approve/reject specific permission upon request and only grant it while using app/this time only.
    - rany_ 4y ago
      Well, the big scary warning is important to grab the attention of people that don't understand the significance of installing said extension. You'd be surprised by the amount of people that are shocked by the fact that an extension they installed has blanket permissions.
      - madeofpalk 4y ago
        Exactly. You see the motivation now.
        rany_ 4y ago
        I see the "motivation" but I meant that if they were being genuine they should have attempted better extension install screens. The current one just lists "Access to all websites" as a normal permission as if it's no big deal.
  - random_cynic 4y ago
    > I'm sure the future without MV2 will have users launching .exe files to mod Chrome which is much much worse Average internet (hence chrome user) don't even know what mod means. They don't care about ads (at least not enough to actively make any change). If the ads become too annoying they'll just skip the video or won't visit a website again and the people serving the ads know that.
nicexe 4y ago
The "none" comment comes from the point of view developing this specific browser extension.
- ithkuil 4y ago
  Other extensions would possibly list some benefits but also possible more problems?

m00x 4y ago

Won't this break Honey's extension business model where they inject Referer to steal referral $?

swyx 4y ago
didnt know that. where can i read more about this?
kevincox 4y ago
I thought their primary business model was seeking user data?
- seanw444 4y ago
  No, the draw is that they supposedly don't. Hijacking referrer data makes sense as to how they manage without that.

betwixthewires 4y ago

So why don't we fork the chromium upstream code and only merge security patches? Imagine, all the web extension maintainers just started maintaining for the forked browser because it's the only one they can continue to support. This would surely destroy the chrome monopoly.

josephcsible 4y ago
I think you underestimate how much work maintaining that would be. Also, who's "we"? Are you going to do it?
c0nducktr 4y ago
> So why don't we fork the chromium upstream code and only merge security patches? Are you volunteering to do this? Do you have the time for all of that? Edit: Why not just use firefox?
- neoberg 4y ago
  I want to use Firefox but it drains the battery so fast that there's usually no time left to use it.
Jorengarenar 4y ago
And it will get popular between end-users because?
- the_third_wave 4y ago
  Manifest v3 will be pushed into Android and the Android Webview component and as such become the standard browser for a lot of people. Android makes it possible to change the Webview to something else but most people just leave it as is. Android also doesn't restrict browser choice like iOS does but most people still go with the last version of Chrome since that is what the device came with. With Firefox being led astray due to its activist CEO deeming it more important to use her position to promote identity politics and other destructive ideologies, Brave tainted by its shady crypto/currency ties and most other Blink-based forks - Bromide, Ungoogled Chromium et al - being marginal players at best and Safari being "the new IE" it is to be expected for Manifest v3 to become the default standard bar the rise of a viable alternative. Where is the new Firefox, or maybe Ouroboros - the snake that eats its own tail in a perpetual cycle of birth, destruction and rebirth - is a better name? Where is the GNU browser engine, built to serve the user instead of its master?

deleted 4y ago

[deleted]

bee_rider 4y ago

It sure is going to be annoying when approximately 0 people switch over to firefox due to the manifest V3 stuff.

bryanrasmussen 4y ago
probably the people who would care are already there. who saves a website to their local machine other than tech people anymore, for example.
- mastazi 4y ago
  I care and wasn't already there. I went from Firefox to Brave after the mobile extensions fiasco but, now, I'm coming back to Firefox because of v3 (Brave said they will not block v2, but due to the fact that they don't have their own store, you are forced to do installs from zip files, without auto update, which sucks).
akmittal 4y ago
It won't be 0, but very few to make a difference. I moved to MS edge because it blocks ads on mobile.
- jonas-w 4y ago
  And why not firefox on mobile with ublock origin?
  - meibo 4y ago
    Firefox on Android has terrible scrolling latency/stutter for me and seemingly for a lot of people. On a 120hz screen, which chrome-based browsers can pull off fine, it's a real dealbreaker.
    - sexy_seedbox 4y ago
      Try Firefox Beta, the scrolling is smoother on there and has more features not in the standard version.

tsujp 4y ago

Honestly I hope Google go through with this as it will direct people to Firefox so they can continue using ad-blockers like uBlock Origin. I don't know how many will come but if Google wants to implode their plugin ecosystem in favour of more advertising, and if that action increases Firefox adoption (and thus a healthy browser ecosystem via competition) then I am for it.

hericium 4y ago
Google may try to enforce MV3 on Firefox. 90% of Mozilla's income comes from Google and while Google needs this controlled opposition, they may lower their input to almost-suffocate Mozilla whenever they desire.
- dmitriid 4y ago
  They don't have to do that. They have technical means to suffocate Mozilla. See this thread on sabotage: https://archive.ph/2019.04.15-165942/https://twitter.com/johnath/status/1116871238922776576 https://archive.ph/2019.04.15-165942/https://twitter.com/joh... (archived), https://twitter.com/johnath/status/1116871238922776576 https://twitter.com/johnath/status/1116871238922776576 (original)
  - random_cynic 4y ago
    So google is trying to both kill Mozilla and keep it alive? Are they trying to create a Schrodinger's Mozilla?
    - dmitriid 4y ago
      For a while Google needed Mozilla (and Safari) to point at and say: see, competition. Now that they have Edge, they need neither. Because they can now pretend that Edge is something else but a glorified Chrome fork and follower. See, for example, WebTransport which as a standard doesn't even exist beyond some scribbles on a napkin https://web.dev/webtransport/ https://web.dev/webtransport/ --- start quote --- The WebTransport features described in this article are shipping in Chrome, Edge, and other Chromium-based browsers, starting with version 97. Firefox does not currently have support for WebTransport. Updates on their position can be found in this GitHub issue. Safari does not currently have support for WebTransport. --- end quote ---

2Gkashmiri 4y ago

haha... with microsoft now touting "VPN", the same VPN nonsense BS that facebook did many years ago on mobile because they wanted to extract ALL the data, ALL the time for literally no cost and no benefit to users, this looks like yet another M$ BS.

Jorengarenar 4y ago
Where did Microsoft come to the equation from?
- tech234a 4y ago
  https://news.ycombinator.com/item?id=33037171 https://news.ycombinator.com/item?id=33037171
xani_ 4y ago
FF is doing same thing with VPN lmao
- 2Gkashmiri 4y ago
  nah, FF is reselling mulvad vpn if i am not wrong, plus that is a paid offering so its not like the masses will join it in droves.

la_fayette 4y ago

I have the strong feeling, that so many people like to watch ads. People like to watch ads more than the actual content. So chrome, egde and safari are and will be the people's browsers. Why even bother?

kaixi 4y ago
I like ads, but detest cookie banners. Good ads can teach you a lesson about copywriting or storytelling, cookie banners are pure time wasters.
kramerger 4y ago
Sergei, is that you?
- la_fayette 4y ago
  No

erklik 4y ago

I've commented this before in a different thread. It's time we, developers, truly switched to non-Chromium browsers. It's Firefox. The answer to all this is Firefox. Firefox is a legitimate alternative, it works for >99% of the world's websites and is an actual alternative i.e. not a fork of Chromium. We need to support Firefox. I've been using it for nearly the last 5 years full-time and have never needed to open Chrome. Do some Google websites perform worse on Firefox? Sure, but the entire reason that's because people don't use Firefox enough i.e. some websites are worse on Firefox. It's a cycle. People don't use Firefox enough, which is why some websites are not performant on Firefox and so on. Firefox expanded and became famous because of a large amount of developers telling their families and friends that it's the better browser. Same was the case for Chrome. This needs to happen again. As a side note, can someone at Mozilla please make it so that I can donate directly to Firefox? Is that not possible for some reason? If I knew that Mozilla wasn't going to spend my money on some stupid new idea, and it would directly to supporting Firefox development, I would defintely pay a subscription each month to Firefox, and feel like a lot of other people would too.

avian 4y ago
Firefox will follow Chrome with this. Over time they always tend to copy Chrome instead of going their own way, as much as their users complain. They similarly already moved away from XUL extensions in the past. I'm sure they will write a heart-breaking story about how supporting Manifest v3 extensions and removing WebRequest blocking is critical for safety and privacy on the web.
- kramerger 4y ago
  Firefox is already supporting v3 while _also_ supporting v2 for adblockers. Stop these random excuses.
  - avian 4y ago
    I use Firefox exclusively, on my computer and on my phone. I am also incresingly frustrated by the direction Mozilla has been going with it and have very little illusions left what their motivations are.

akmittal 4y ago

Is Microsoft edge going to implement Manifest V3. I found it to have same features as chrome but better privacy.

tech234a 4y ago
Edge is a Chromium fork now, and Microsoft has announced that they will be following Google's timeline for depreciating manifest v2, though it looks like their timeline hasn't been updated with the information from Google's latest timeline delay [1]. [1]: https://learn.microsoft.com/en-us/microsoft-edge/extensions-chromium/developer-guide/manifest-v3 https://learn.microsoft.com/en-us/microsoft-edge/extensions-...
deleted 4y ago
[deleted]
NayamAmarshe 4y ago
> I found it to have same features as chrome but better privacy. Oh boy. Edge is actually worse than Chrome in privacy and data-collection, that's a feat in itself. Source: Trinity College, Dublin Research Paper -https://www.scss.tcd.ie/Doug.Leith/pubs/browser_privacy.pdf https://www.scss.tcd.ie/Doug.Leith/pubs/browser_privacy.pdf

deleted 4y ago

[deleted]

charcircuit 4y ago

I think people are failing to understand that Google wants to start MV3 from a more secure and privacy protecting state and figure out how to incrementally add capabilities without compromising that. Making the tradeoff of reducing your security / privacy / performance for more freedom is not the right call for most people. Extension authors have abused their freedom so it should be taken away.

the_gipsy 4y ago
Bottomline is that adblocking extensions are dead.
- SquareWheel 4y ago
  Have you actually tried using uBlock Origin Lite or Adguard on MV3? I've used both and they have worked flawlessly. Currently I prefer Adguard because all websites are opted-in to cosmetic styling by default.
  - the_gipsy 4y ago
    I can't, because MV3 is not in my version of Chromium yet. But I don't need to: I know exactly how MV3 works, I have experienced that approach on iOS and it barely works for the most simple kind of ad-tech. Calling it "flawless" sounds like outright FUD to me.
    - SquareWheel 4y ago
      FUD is making a dismissive claim without actually testing it. Using the stripped down content blocking in iOS is hardly comparable.
      - the_gipsy 4y ago
        iOS works in the exact same principle as MV3.
  - 4y ago

dedoussis 4y ago

> With Manifest V2, it was possible to inject a "Referrer" HTTP header if necessary. With Manifest V3, it's no longer possible. Not entirely sure of how this is true. A recent V3 extension I've built is able to inject both the "Referer" and "Origin" headers using a declarative net request ruleset: 1. manifest.json (referencing the rules.json file): https://github.com/dedoussis/icloud-hide-my-email-chrome-extension/blob/main/src/manifest.json#L19 https://github.com/dedoussis/icloud-hide-my-email-chrome-ext... 2. rules.json: https://github.com/dedoussis/icloud-hide-my-email-chrome-extension/blob/main/src/rules.json https://github.com/dedoussis/icloud-hide-my-email-chrome-ext... 3. Relevant docs: https://developer.chrome.com/docs/extensions/reference/declarativeNetRequest/ https://developer.chrome.com/docs/extensions/reference/decla...

dedoussis 4y ago
Oh actually SingleFile is not attempting to set the headers but modify them, which seems to not be possible with V3. That makes sense.
deleted 4y ago
[deleted]

a3w 4y ago

Is the title a reference to: "Now witness the power of this fully armed and operational battle station" from Emperor Palpatine? Nice foreshadowing, the battle station did not "go poof" in that scene, though, like singlefile-lite does, thanks to manifest v3.

1vuio0pswjnm7 4y ago

https://arstechnica.com/gadgets/2022/09/chromes-new-ad-blocker-limiting-extension-platform-will-launch-in-2023/ https://arstechnica.com/gadgets/2022/09/chromes-new-ad-block... "Google says Manifest V3 is "one of the most significant shifts in the extensions platform since it launched a decade ago." The company claims that the more limited platform is meant to bring "enhancements in security, privacy, and performance."" Big Tech is not exactly known for its honesty. If it does not also increase profits and/or decrease losses then there is no sense in pursuing it. There is literally nothing Google does that is not sold as being for the benefit of its data sources and ad targets, i.e., "users". Doing things that help lure in or retain the data sources and ad targets is not not the same as doing thing that actually benefit them. At best, what Google does is make compromises, but the announcements never acknowledge any compromise. Everything is a win for the data sources and ad targets. If we are to believe their rhetoric Google's interests and "users'" interests are always exactly the same. Impossible. "Privacy groups like the Electronic Frontier Foundation (EFF) dispute this description and say that if Google really cared about the security of the extension store, it could just police the store more actively using actual humans instead of limiting the capabilities of all extensions." As if anyone else, besides people obligated to support Google, would not "dispute this description". We do not know because those other people are never asked. None of them asked for an update. They have no choice in the matter. Ambivalence does equate to agreement. It makes one wonder why does Google even bother to purportedly disclose the motivation or justification for an "update". No one has a choice to reject it. We never see any evaluations fo the source code changes. So-called "users" are not the stakeholders in this project. "The EFF poked holes in most of Google's justifications for Manifest V3 changes, saying that malicious extensions are mostly interested in stealing data and that Manifest V3 only stops extensions from blocking data, not inspecting it, so Google isn't doing much to stop bad actors. The report says performance also isn't a valid excuse, citing a study showing that ad downloading and rendering degrades browser performance." Tell us something we do not already know. Google's customers are not "users", they are advertisers. As such, statements about the advantages of an "update" really should relate to the advantanges for advertisers. Any other statements are just meant to lure in or retain the data sources and ad targets.

shadowgovt 4y ago

dedoussis 4y ago

> Benefits of the Manifest V3: none V3 not allowing remote code execution is actually a serious benefit. Of course, this does not negate the fact that V3 is mainly there to boost the ad ecosystem of Google, but I'd never want my screen casting extension to be mining bitcoin on the background. That said, I'm not sure how this is going to scale long term, given that it sometimes takes 2+ weeks for the web store review team to approve a genuine one-line change. Lack of RCE is only going to make this review backlog bigger.

rasz 4y ago
>V3 not allowing remote code execution is actually a serious benefit. This is Google Kool-Aid. When Google says "remote code", they mean _remote to google_. Your own script on your own drive is remote to google. Google is removing User from the User Agent.
- dedoussis 4y ago
  Well, in this instance remote code actually means remote. In V3 one can no longer use the tabs.executeScript API [1] in which you could pass an arbitrary server rendered string. [1] https://developer.chrome.com/docs/extensions/reference/tabs/#method-executeScript https://developer.chrome.com/docs/extensions/reference/tabs/...
  - rasz 4y ago
    V3 kills Userscripts (tampermonkey/violentmonkey). You will no longer be able to execute your own code written with your own hands&brain and stored on your own hard drive.
    - abraham 4y ago
      Userscripts should go into testing soon. https://developer.chrome.com/docs/extensions/mv3/known-issues/#userscript-managers-support https://developer.chrome.com/docs/extensions/mv3/known-issue...
    - 4y ago

josteink 4y ago

Devils advicate: I know hating on manifest V3 is popular. I know especially content-blockers (which I myself enjoy!) face issues with the new permissions model. That said, I've ported an above moderately complex extension from manifest V2 to V3 and found the experience quite OK. * The permission model is more clearly defined. * Background-workers instead of background-pages makes for a more consistent API. IMO background-pages were always weird. * Usage of obsolete APIs which may have "suddenly" failed in V2, now actually immediately causes runtime-failures in V3, making sure you've get all of them upgraded. * You need to be explicit when doing "dangerous" things like injecting scripts. There's nothing accidental about this. This clearly improves security. * Time taken? Roughly one work-day. * No functionality lost. Right now, as a developer, my only complain about V3 for this extension... That I no longer can have a single, consistent codebase for the Chrome and Firefox-versions, because Firefox doesn't yet support V3 in their regular end-user builds. But once they do, that problem will be solved too. And as an end-user, I really feel this security-model makes extensions which can operate within the V3-constraints more trustworthy than similar extensions implemented using V2.

raxxorraxor 4y ago
> You need to be explicit when doing "dangerous" things like injecting scripts. There's nothing accidental about this. This clearly improves security. What do you mean here? How do scripts get included explicitly?
danpalmer 4y ago
Thank you for adding some context to this that seems missing from all discussion I've seen so far. Extensions have always had a dodgy security model, and given the nearly unprecedented access they have to our data and habits, it's important that this is being improved. Most users aren't going to be able to tell the difference between a good extension and a malicious one, and even developers who would like to think they can probably can't in many cases. It sounds like security and performance are significantly improved, and these are both things that the tech community are usually big supporters of. But in this case it comes at the cost of some flexibility with ad-blocking, and if there's one thing we love more than security and performance, it's a chance to point the finger at big tech. There's a lot of nuance that has been lost from the ad-blocking discussion.

hdjjhhvvhga 4y ago

Actually it's a great ad for SingleFile and FireFox. Seems to work great so far.

xani_ 4y ago

Why is FF going with it ?

creesch 4y ago
Simple, they switched to the webextension API a few years ago as it makes development of extension across browsers much easier. More directly put, developers would develop extensions for Chrome and more often than not would not bother with Firefox as the framework it used was different. By switching to the same framework for developing extensions it now means that it takes little to no effort for developers to also publish it for firefox. Having said that, Firefox is providing compatibility with manifest v3 while at the same time not implementing some of the restrictions that are in place in the Chrome implementation.
- pessimizer 4y ago
  > Simple, they switched to the webextension API a few years ago as it makes development of extension across browsers much easier. Great idea to prioritize interop when the people who you're trying to interop with are gulping large chunks of your userbase. Very important to make sure that Firefox had parity with Chrome in extensions, the only area where Firefox previously had a massive advantage over Chrome.
  - creesch 4y ago
    > the only area where Firefox previously had a massive advantage over Chrome. It didn't though, because the API was different a lot of extensions that appeal to a broader user base were not made available on firefox (anymore). Yes, the previous framework did allow other use cases more suitable for power users but those are a fraction of the total user base. And in general it hugely simplified extension development. Instead of having to maintain various code paths for different browsers and accounting for slightly incompatible APIs this was no longer needed.
RunSet 4y ago
> More than 90 per cent of Mozilla's funding comes from web search providers that pay for the right to be the default search engine in Firefox in their regions. According to the organization's latest financial figures, $430m of its 2018 total revenue of $451m came from those internet giants – primarily Google https://www.theregister.com/2020/08/14/mozilla_google_search/ https://www.theregister.com/2020/08/14/mozilla_google_search...

hanselot 4y ago

Has anything good come from a manifesto in history? Or is it selection bias that I only associate the word with dictators and genocides?

gildas 4y ago

Author here, I just wanted to add that most of the "features" should be fixed by Google this month [1]. That leaves me approximately 2 months to finish the work and hope to make the transition in January \o/. This delay is a bit short though. [1] https://developer.chrome.com/docs/extensions/mv3/known-issues/ https://developer.chrome.com/docs/extensions/mv3/known-issue...

dancemethis 4y ago
Gotta add _somewhere_ an introduction to what it actually is. I could figure it is _related_ to extensions, but what it _is and does_ is nowhere. Only empty buzzing like "It is an evolution of the extension platform that takes into consideration both the changing web landscape and the future of browser extensions."
Zababa 4y ago
Thanks a lot for SingleFile, I use it all the time to save web pages and it's great!

shadowgovt 4y ago

> Benefits of the Manifest V3 * This extension is much less likely to consume all of my JavaScript resources when it malfunctions * I, as the end user, can install this extension without fear that arbitrary code execution of code sourced from the web means the extension creator can change the extension to harvest my data later without anything changing in the Chrome Web Store to indicate this has happened The bugs need to be fixed, but the benefits are for end users not developers.

josephcsible 4y ago
Those benefits are like saying a benefit of having a flat tire is that you're way less likely to get a speeding ticket while you do. Or even better, like the benefits of the Sun going out that https://what-if.xkcd.com/49/ https://what-if.xkcd.com/49/ lists.
- shadowgovt 4y ago
  It's about tradeoffs. From where I sit (not running an ad blocker, but yes running several extensions on a corporate machine), the benefits outweigh the costs because while currently corporate IT has to allow-list every extension one-by-one, Mv3 allows them to have a policy where they trust the Chrome Web Store and allow us to install extensions as long as they don't demand XYZ permissions.

jen20 4y ago

The objective listed makes no mention of what this project _actually is_ - infuriating.